Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 19:29 UTC
Static task
static1
Behavioral task
behavioral1
Sample
db12399cfa94a3003eb603a2a5bab6dc_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
db12399cfa94a3003eb603a2a5bab6dc_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
db12399cfa94a3003eb603a2a5bab6dc_JaffaCakes118.html
-
Size
4KB
-
MD5
db12399cfa94a3003eb603a2a5bab6dc
-
SHA1
2db9dd88e50c946a3929f87bc9bfaeb95b5ddf2a
-
SHA256
4bad87ffc02a809469d40c3872c7c89bd200844aba2ec4ec62e5cbb3e52ae5e8
-
SHA512
fecf1c6906a0510d4137d654ca065afe316d237dadd44bb217053102faf047a88c1648ecb3df99b5411e29f03846b4dbad43810d0ecab3ab4e5a7c339fa7cc31
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oQHcJ4d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDH
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000046f9548e645d7b7c6cb14da65f4d420078fc98d94602faa1b50cb4c51ad8aee000000000e8000000002000020000000e791afd3720b9b37c181efdf240c187e894b53f1e1830513dc48fae869416e4690000000a11b2b8d795ecfc95541663446d91b8bf7204aecbe92b985cc72dbbed90808734ccaa1e2b92c991354b79358a678caab584e0a096e249344220b64ec4596f898cf1724003403f3e9b900d5b58e5d0e2aa475206e22d744846c648e6be3cf832822c873dcc43a5780f8c5ede3358104e56a0c7cd3b6df621a512a02028f0c088a3b9e06883f8058c3bfb2add749dfe4234000000079965e5515c761e00295cbb46c5f9faf037a2a975806e1b7ab80b9430e4887d0eb5fa8dd589fa1914250765180e890bdf3ba85f2889c4177a8d7cace34b335b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000953a7ebf449bbb5e4adfb15b22ff01d5d60a901ca56845a5a9668b19fdc1bd24000000000e80000000020000200000001b4faf10719fc57513c83456b8810900ade510159018902cbba098d830ff0762200000008d4b910e127d796f63275d9c7f22eb2c18bc168c1ea8df9bd7ae22cedb47191b400000008740c2603ef7ca0756fbce1e72b6bd2c5bc9b5585293906a3915a6f1461430ba958dff49d2ecf0fd19712ed7a55e1b20040e35b26c1aab84f0fea23be610273b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{264B5861-7074-11EF-838C-C20DC8CB8E9E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432244837" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c003c1fa8004db01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2520 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2520 iexplore.exe 2520 iexplore.exe 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2360 2520 iexplore.exe 30 PID 2520 wrote to memory of 2360 2520 iexplore.exe 30 PID 2520 wrote to memory of 2360 2520 iexplore.exe 30 PID 2520 wrote to memory of 2360 2520 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db12399cfa94a3003eb603a2a5bab6dc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e6ddf28e30034083ca3c6761faf30b8
SHA13ca8a5eba7e85b49848d153101341e396e33c874
SHA25640d8b94ca81104fe4798232adc8e2d7b0bbbea1085a308e525295ad9f684d857
SHA51280c2b47939a7fee747af05bd30406579fec34fb96e393344dca5585ca2321da3ac1df42888c53bac18f73764360f4c17abdd2e3e34d7324e4a87b47b90130def
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad272d7c56f7232a4bc186b3343c4c4e
SHA1485e1942603060aea9114b6c5b8d817dd239c46c
SHA2567c15b5d1a083bb2586e5495261efb0bfd24b9f1ab0da301b8e82257ce152d443
SHA512fa0d26f86e59cb93143832f2a7bdf441776e632fd3bcdab1e5ccf881fa2ab596b08081f1e469b35536a68322092eb56ae52b0fbf047ae42192a6903690f8279b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59758e6fbc1a15d667bbdb55a2b26b831
SHA10f6b03f7b0d9f659e89cfcb7d8ce9657de490256
SHA2564f6a1738ca21f4ff39fa8d00159b9ab7878e3e221edaf9f2269ab5c052b5195e
SHA51268668fdb31a6f7605516a369c64ea7ecd800a4879e19bfae2857006e4e24c28f8dcbc9ecd3c17af5fa4f12792a03c36fdeebcc534df3c96321aec8d5b2aaf1b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50630becb7e4eec4277ae77e2af5f7cd8
SHA11ab9362370486e774df2086597bda5ea5c01682d
SHA25610d7895c64241b3b5417bbabfd1fa9b8c5623307d2fa6cb4831403015f9e2b9b
SHA5128745eb2b9426510157400749d7d81eeeee5f07c003575e08dcb7741ca3f391fe55048d92d12d9d2170856588ac174234b446066944844e5798530d951cac4862
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58149557570e01d8d41264c6e72d73714
SHA1b12f7f29098428db8af23ae91b7d5174ef605495
SHA256f2487831b0c1cde26c8e78dd73eec248e56c5d0a72b0c611685b4ea1391727f0
SHA5126413e6b0dd21c4f2f0dcd16b5390e0e04ab8d950a99f2f3a1cea0c75a6612a359e629f51a4c2b6a5fc7bfa75db46df91be76344e5055754035e7446782ed148c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0e9c590d460675a7315a5c05400aaa9
SHA1c4e02238ef7616a7b6eca6701a2ee63ef69ce57d
SHA2567feee084832850d11ecd7b9523699aee410f3436b2910ea991e968337b334e35
SHA5121b839c5b9ac61ff7f16816fdbc7aa18a6affddbe5616667a664928613f49f2f0d5588f29bceb04a7de9e250120dc3342cefc4b85b1e9bfb606cd2b553c91b38f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5632807951a76e06993caeeba417f45af
SHA1d0e141cbf04664cc9e70e4ba3a5db8c5a9b7eeb4
SHA256b6271072a5ff4b4d57c1c982c769a54623c8f6fdd954fca9d8f8ad2112fbdca5
SHA512604dee69459f3d1edccdf37e519281e2e318b7d67f3bb39628513bb40dc78bf60beb459ed528161a0331135bb306f314e20e5504a3f5bd0a5b94f438232ebaba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b86273e3361ae3096a0557b82483741
SHA167433af89d6df18cb1f373801ceaedd934c713a0
SHA2564b7b061db449fb083e18e541d2ec556feb6771374a2a8f81f4f1b62088af613a
SHA5121378b92eb7f550e37e9ed71c593d9a40aebec8915df83f11f812ca8ff36ef2b1bf48ac6a82810f8f2f3e66d93d48cacde156ac83f101b5551aaa908c5393466d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50706025dab6dbc14a68796c51a108b97
SHA12c2703669892efbc581e9a2bc02a15fcfe335ba9
SHA256a6a74be508ef51ffb7f9a8c107d4c149d078cf50817d46729d7d715d003b2166
SHA5123c1085acaf1440c1cd6ed329a988a56b8f44a3457e5160a34a2ca13b6689838d5af11ee0cd8de54109258d84c36b111023546b0237d47377f192731410d50bc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57861f588fbae75fab312296e7c42cb1d
SHA1cce317c09148b829eda5e4da820c6835278a7197
SHA256c52e28fb32008f219f275135f293b90f5ec190c8d08a82416cc63b8ba39c62cd
SHA512802f0230080aec0fabe390e371221ecd55a00d750ff81fe7943f4b1e0184b64ebca5364d9c781df7d46d4a137113400db1b423bb62198d98223fc8f4e5b0415f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b54a11e18d6209f214c24898c302a0b8
SHA1a7cf2aa96c1c14e4981fff123c828de0aa160ded
SHA25651e55a5e492c3fb08cd292ee425a65cbbba56b6095111ed928fdd54e005d4be8
SHA5120596f03269d8796c8ed8ec2b46d653d04aed9044e1ba3c5c53a9595e34fd973c0a1051bd4566daaff0fe050b28ce13ef351d0226d117b0ae81fbdce2b4930fa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f036992a26e3bec2ba8de1a9c3ff33a8
SHA1ebeb2649ebe4a836050ca7c2fc691adda4baee67
SHA2567c342f6bd099b1bb9690dac8a5cb07b02f6f2af847b41b34904a8562eaa6f628
SHA5126808877cb3b2a10635ed0dd3e9660da4f84177c1f97b178a9594abdc6157639128c5301fbe3c048aa237604afd4577e722c125c29a84cb4414deddee772b25f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d113a422f5180ee5ea38333693dbb5e
SHA1236aca1a5a2ba04716ca72abfbab1ff0c39e4c03
SHA2563bbf7e69772e76e7eab7eccefb239414c9e5c4206acad8acb9de9818fb35f850
SHA5123a3033eea03621e39b005ae3f8af5c6cec0a876c2b0a9dea81a943997fba5cccc5e2dde19c19bec1b61a199d17217dc4f9474705d245fe1c4c91206e495a7d8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53309c87a0a767c5129746009b4aa98cc
SHA18495fa79b90201ee9eabb8570b84d5ed79f04621
SHA25637263b92ecb7f0c2b364c08ac6077e89c1525118d0ff47762975556aa6023033
SHA512df7a1f926ad663345ef93a41797533f03d940d94a6dd0ad23d0af9d1cc8315b25ffc12050cebf7f3ec1a36e021822e53d2e34e78057f0aa889137e1e741542d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51978410240255647317c8d48ae30319f
SHA1923ba9bc996e125fc727ac9ada7070f2a14d1460
SHA25669ad6f518d057deeeacef8d0773e41c3c96b2ee337e2b9642ef4581383acfd3a
SHA51209e05e37320ccb020e20410e645f15a5b2af11f4d23897c08a278d761136925c58805ea96fa95f42d76948490146d498a58e7fa1f8aa0cf8f36fe5ccecc757a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f971cbd52b83efd31dd2dda29ccaeac0
SHA190ff711ef87bfeca620ea751d4c7840e25e6c2e3
SHA256c39a03a55be42ceb048256ef84563bf7a47c4f9388ee8ab846f88fc6d8bd041d
SHA51257c6ef3f70822f7c7f482ac6a61e231352bc8c8398a614bca10faefed2e5f4a869933661298638f0b9ade0cf945e2c668ee5ed00de4c1b08e49dff9edc198672
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3ce2060e59efaf15b7a61f60d547335
SHA1022c7d3700665efa2c490b8316c65207340804ea
SHA256e99ce689205af756fc379e4c437131dddea67cd576785692f8928ae2cb5bdeba
SHA512fb48ee4cf25adeaac4ba05f39078f4501145e40a4c89dceedd8104c40614f4ee6f344bd935d1dabf03edef04b829956fd4b50d33d20ad152e8f16127e02478c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be30758b3d9e473f1a3f093cec18b68a
SHA1cdc97d834468c12b81b496e065d89d115cf5c66f
SHA25653d7fedf21dd989e216e75062c69971b2cb12f72c61a4d0e92af519bff433f69
SHA512d9b0ff21ffd0345abcbf52e2efc1bddeed207973ba2e0c9ab7fd4553cc6d7961e164bcd4ffd9363cd8dade11fa0bb0c947e78bd1d6d99696b777a86e217a92f7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b